1.7 Define, Measure, and Report Security Metrics ISSMP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What does it mean to 'map a metric to the organization's risk posture'?

   • ALinking the metric to specific risks or controls that it measures
   • BAssigning a numerical value to the metric
   • CDisplaying the metric on a dashboard
   • DComparing the metric to industry benchmarks
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   An organization with a low risk appetite is selecting security metrics. Which metric is most appropriate?

   • ATotal cost of security tools deployed
   • BPercentage of systems with critical vulnerabilities unpatched for more than 48 hours
   • CNumber of security awareness training courses offered
   • DNumber of security team members with certifications
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which statement best defines a Key Performance Indicator (KPI) in the context of security management?

   • AA metric that measures the total cost of security operations
   • BA qualitative assessment of the likelihood and impact of a specific threat
   • CA metric that quantifies the performance of security activities against strategic goals
   • DA metric that provides an early warning signal of increasing risk exposure
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team tracks the KPI 'percentage of security patches applied within 30 days of release'. The metric has been stable at 95% for the past year. However, the number of incidents exploiting known vulnerabilities has increased by 40% in the last quarter. What is the most likely explanation for this discrepancy, and what should the team do?

   • AThe KPI is correct, and the increase in incidents is due to a new threat actor; the team should accept the trend
   • BThe KPI is not a valid measure of patching effectiveness; the team should replace it with a new metric
   • CThe KPI is measuring the wrong population; the team should investigate which systems are being exploited and whether they are covered by the KPI
   • DThe increase in incidents is unrelated to patching; the team should focus on other controls
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A CISO is building a metrics dashboard for two different audiences: the board of directors and the security operations team. The board needs to understand the overall effectiveness of the security program. The SOC team needs to understand the effectiveness of their detection and response processes. Which pair of metrics best serves these two distinct audiences?

   • ABoard: percentage of systems patched on time; SOC: number of alerts generated per day
   • BBoard: percentage of critical systems with approved security baselines; SOC: mean time to detect (MTTD) and mean time to respond (MTTR)
   • CBoard: mean time to respond (MTTR) to incidents; SOC: percentage of systems patched on time
   • DBoard: number of security incidents; SOC: number of security incidents
   Reveal Solution Discussion Select an answer first